@electerm/electerm-react 5.5.35 → 5.5.66

package/client/common/bookmark-schemas.js

@@ -62,6 +62,7 @@ export const sshBookmarkSchema = {
   enableSftp: z.boolean().optional().describe('Enable sftp, default is true'),
   useSshAgent: z.boolean().optional().describe('Use SSH agent, default is true'),
   sshAgent: z.string().optional().describe('SSH agent path'),
+  agentForward: z.boolean().optional().describe('Enable SSH agent forwarding (like ssh -A), requires SSH agent, default is false'),
   serverHostKey: z.array(z.string()).optional().describe('Server host key algorithms'),
   cipher: z.array(z.string()).optional().describe('Cipher list'),
   compress: z.array(z.string()).optional().describe('Compression algorithms'),

package/client/common/constants.js

@@ -302,6 +302,7 @@ export const regexHelpLink = 'https://github.com/electerm/electerm/wiki/Terminal
 export const connectionHoppingWikiLink = 'https://github.com/electerm/electerm/wiki/Connection-Hopping-Behavior-Change-in-electerm-since-v1.50.65'
 export const aiConfigWikiLink = 'https://github.com/electerm/electerm/wiki/AI-model-config-guide'
 export const aiChatModeLsKey = 'ai-chat-mode'
+export const aiAutoCompressLsKey = 'ai-auto-compress'
 export const lastAiChatSessionIdKey = 'last-ai-chat-session-id'
 export const aiTermOfUseConfirmedLsKey = 'ai-term-of-use-confirmed'
 export const syncTermOfUseConfirmedLsKey = 'sync-term-of-use-confirmed'

package/client/common/dangerous-session-fields.js

@@ -0,0 +1,39 @@
+/**
+ * Session fields that must never be settable from untrusted input: a deep link
+ * URL, CLI `--opts`, an MCP/AI tool call, or a shortcut file.
+ *
+ * Every entry reaches one of: child_process.spawn(), a shell, the process
+ * environment, or the terminal input stream.
+ *
+ * Why this is a shared module and not a local array: `proxyCommand` was added
+ * by a later feature and reached spawn() from a single clicked link because the
+ * denylists of the time were five separate copies and none of them was updated
+ * (follow-up to GHSA-mpm8-cx2p-626q). One list, imported everywhere, is what
+ * makes the guard maintainable.
+ *
+ * Why a denylist and not an allowlist: a quick connect string may legitimately
+ * carry any session option (encode, term, authType, agentForward, sshTunnels,
+ * startDirectoryRemote, ...). An allowlist would silently break every field it
+ * does not know about, which is a worse failure than the one it prevents. The
+ * cost of that choice is that a future exec-capable option must be added here.
+ *
+ * Keep in sync with the copy of this file in the other bundle - there is a unit
+ * test that fails when the two copies drift.
+ */
+export default [
+  // spawns an external process (before any SSH authentication)
+  'proxyCommand',
+  // run scripts after connect / override the shell binary
+  'runScripts',
+  'execLinux',
+  'execMac',
+  'execWindows',
+  'execLinuxArgs',
+  'execMacArgs',
+  'execWindowsArgs',
+  // injects environment variables into the session
+  'setEnv',
+  // injects interactive prompts / auto-answers terminal output
+  'interactiveValues',
+  'triggers'
+]

package/client/common/parse-quick-connect.js

@@ -19,13 +19,38 @@
  * 192.168.1.100:22
  */
 
+import DANGEROUS_SESSION_FIELDS from './dangerous-session-fields'
+
 const SUPPORTED_PROTOCOLS = ['ssh', 'telnet', 'vnc', 'rdp', 'spice', 'serial', 'ftp', 'http', 'https', 'electerm']
 
 /**
- * Deny list for opts keys - these are parsed from the URL itself
- * and should not be overridable via the opts JSON parameter for safety
+ * Deny list for opts keys.
+ *
+ * `type` and `host` are parsed from the URL itself, so `opts` must not be able
+ * to override them. Everything else is a field that reaches
+ * child_process.spawn(), a shell, the environment or the terminal input stream
+ * - see common/dangerous-session-fields.js.
+ *
+ * Deliberately a deny list rather than an allow list: a quick connect string
+ * may legitimately carry any session option (encode, term, authType,
+ * agentForward, sshTunnels, ...), so an allow list would silently break every
+ * field it does not know about.
  */
-const OPTS_DENY_LIST = ['type', 'host']
+const OPTS_DENY_LIST = ['type', 'host', ...DANGEROUS_SESSION_FIELDS]
+
+/**
+ * Return a copy of an untrusted object without the denied keys.
+ * @param {object} obj - untrusted object
+ * @param {string[]} denyList - keys to drop
+ * @returns {object} a new object with the denied keys removed
+ */
+function withoutDenied (obj, denyList = OPTS_DENY_LIST) {
+  const out = { ...(obj || {}) }
+  denyList.forEach(key => {
+    delete out[key]
+  })
+  return out
+}
 
 /**
  * Default ports for each protocol
@@ -53,6 +78,7 @@ const TYPE_DEFAULT_VALUES = {
     enableSsh: true,
     enableSftp: true,
     useSshAgent: true,
+    agentForward: false,
     authType: 'password',
     term: 'xterm-256color',
     encode: 'utf-8',
@@ -403,8 +429,22 @@ function parseQuickConnect (str) {
     if (optsStr) {
       try {
         const extraOpts = JSON.parse(optsStr)
-        OPTS_DENY_LIST.forEach(key => delete extraOpts[key])
-        Object.assign(opts, extraOpts)
+        if (
+          extraOpts &&
+          typeof extraOpts === 'object' &&
+          !Array.isArray(extraOpts)
+        ) {
+          Object.assign(opts, withoutDenied(extraOpts))
+        }
+        // a hop entry is spread into a sub-session (server/session-hop.js),
+        // so it is its own untrusted surface and needs the same filtering.
+        // Only the dangerous fields apply here - unlike the top level, a hop
+        // legitimately sets its own host and port.
+        if (Array.isArray(opts.connectionHoppings)) {
+          opts.connectionHoppings = opts.connectionHoppings
+            .filter(hop => hop && typeof hop === 'object' && !Array.isArray(hop))
+            .map(hop => withoutDenied(hop, DANGEROUS_SESSION_FIELDS))
+        }
       } catch (err) {
         console.error('Failed to parse opts:', err)
       }
@@ -451,5 +491,6 @@ export {
   getSupportedProtocols,
   SUPPORTED_PROTOCOLS,
   DEFAULT_PORTS,
-  OPTS_DENY_LIST
+  OPTS_DENY_LIST,
+  DANGEROUS_SESSION_FIELDS
 }

package/client/common/parse-widget-log.js

@@ -0,0 +1,57 @@
+/**
+ * Parse a widget log file into the two streams the widget panel shows.
+ *
+ * The writer is src/app/widgets/instance-log.js; the format is one entry per
+ * line, pipe separated:
+ *   <iso time>|log|<level>|<message>
+ *   <iso time>|conn|<ok|fail|info>|<type>|<from>|<message>
+ * A message may contain pipes, so everything after the last known separator is
+ * taken as the message.
+ */
+
+const CONN_STATE = {
+  ok: true,
+  fail: false,
+  info: null
+}
+
+export function parseWidgetLog (text) {
+  const logs = []
+  const events = []
+  for (const line of String(text || '').split('\n')) {
+    if (!line) {
+      continue
+    }
+    const parts = line.split('|')
+    if (parts.length < 4) {
+      continue
+    }
+    const ts = Date.parse(parts[0])
+    if (!ts) {
+      continue
+    }
+    if (parts[1] === 'conn') {
+      if (parts.length < 6) {
+        continue
+      }
+      events.push({
+        ts,
+        ok: Object.prototype.hasOwnProperty.call(CONN_STATE, parts[2])
+          ? CONN_STATE[parts[2]]
+          : null,
+        type: parts[3],
+        from: parts[4] === '-' ? '' : parts[4],
+        msg: parts.slice(5).join('|')
+      })
+    } else {
+      logs.push({
+        ts,
+        level: parts[2],
+        msg: parts.slice(3).join('|')
+      })
+    }
+  }
+  return { logs, events }
+}
+
+export default parseWidgetLog

package/client/common/safe-join.js

@@ -0,0 +1,33 @@
+/**
+ * Join a base directory with a filename that may come from an untrusted source
+ * (a remote server's directory listing, a drag payload, ...) and keep the
+ * result inside the base.
+ *
+ * The sanitize step is load-bearing, not cosmetic. electerm's `resolve` does no
+ * normalisation and three of its branches discard the base outright: a leading
+ * `/`, a UNC `\\`, and a Windows drive prefix. The drive branch is the easy one
+ * to miss because it needs no separator at all — `resolve('/uploads', 'C:x')`
+ * returns `'C:x'`. Stripping `:` and the separators removes every one of those
+ * branches, leaving only the "append to base" path.
+ *
+ * @param {String} base directory the name must stay inside
+ * @param {String} name untrusted file name
+ * @return {String} base + separator + a safe name, always inside `base`
+ */
+
+import resolve from './resolve.js'
+import sanitizeFilename from './sanitize-filename.js'
+
+// A single path component: no separator, and not `.` or `..`.
+const SINGLE_COMPONENT = /^(?!\.\.?$)[^/\\]+$/
+
+export default function safeJoin (base, name) {
+  const safeName = sanitizeFilename(name)
+  // sanitizeFilename already satisfies this, so the fallback is unreachable in
+  // practice: it is here so that a future change to its character list degrades
+  // to a neutral name instead of escaping the base. Deliberately not a throw —
+  // a bad entry in a remote listing must not take down the whole drop. It also
+  // stays silent on purpose: no legitimate name contains a separator, so the
+  // only names that can reach the fallback are hostile ones.
+  return resolve(base, SINGLE_COMPONENT.test(safeName) ? safeName : 'unnamed')
+}

package/client/common/sanitize-filename.js

@@ -14,6 +14,14 @@
  * - Reject reserved Windows device names: CON, PRN, AUX, NUL, COM1-9, LPT1-9
  * - Limit filename length to 255 bytes (common filesystem limit)
  * - Fallback to 'unnamed' if result is empty
+ *
+ * Note for callers using this to build a path: the output is guaranteed to
+ * contain no path separator (`/` or `\`) and never to be `.` or `..`, because
+ * all of those are in ILLEGAL_CHARS or stripped as trailing dots. That is what
+ * makes `resolve(dir, sanitizeFilename(name))` stay inside `dir` — and it is
+ * load-bearing for path containment (CWE-22), not just cosmetics. Prefer
+ * `safeJoin(base, name)` when the name is untrusted: it depends on this
+ * property and asserts it.
  */
 
 // Characters illegal on Windows (and problematic on many systems)

package/client/components/ai/agent-tool-call-card.jsx

@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react'
+import { useState, useEffect, memo } from 'react'
 import { Tag } from 'antd'
 import {
   CaretDownOutlined,
@@ -34,7 +34,11 @@ function formatResult (result) {
   }
 }
 
-export default function AgentToolCallCard ({ toolCall, autoCollapse }) {
+// memo()'d on the entry object: `formatResult` JSON.parses the whole tool
+// result on every render, and an agent turn can hold dozens of these. The
+// agent loop swaps in a new entry object when a call finishes
+// (runAgentLoop), so an unchanged card keeps its identity and is skipped.
+export default memo(function AgentToolCallCard ({ toolCall, autoCollapse }) {
   const [expanded, setExpanded] = useState(toolCall.status === 'running')
   const { name, args, status, result } = toolCall
   const Icon = toolIcons[name] || CodeOutlined
@@ -110,4 +114,4 @@ export default function AgentToolCallCard ({ toolCall, autoCollapse }) {
       )}
     </div>
   )
-}
+})

package/client/components/ai/agent.js

@@ -1,9 +1,31 @@
 import { agentTools, executeToolCall } from './agent-tools'
 import { appendMandatoryGuardrails } from './ai-guardrails'
-import { buildAgentMessages, summarizeContext } from './ai-context'
+import { buildAgentMessages, summarizeContext, CONTEXT_DANGER_PERCENT } from './ai-context'
+import {
+  shouldAutoCompress,
+  canCompact,
+  applySummary
+} from './ai-auto-compress'
+import {
+  autoCompressEnabled,
+  summarizeMessages,
+  autoCompressSession
+} from './ai-compress'
+import uid from '../../common/uid'
 
 const MAX_ITERATIONS = 150
 
+// A summary request that failed (provider hiccup, rate limit) must not be
+// retried on every following iteration -- that would turn a full window into a
+// call per tool result. Only try again once the estimate has grown by this
+// share of the window.
+const AUTO_COMPRESS_RETRY_GROWTH_PERCENT = 5
+
+// Which loop currently owns `store.agentRunning`. A stopped run keeps
+// unwinding for a moment (its last request has to settle), and it must not
+// clear the flag of a run the user started in the meantime.
+let activeRunId = null
+
 function buildAgentSystemPrompt (config) {
   const lang = config.languageAI || window.store.getLangName()
   const baseRole = config.roleAI || 'You are a helpful assistant.'
@@ -27,14 +49,10 @@ Reply in ${lang} language.`)
 }
 
 function updateChatEntry (chatEntry, updates) {
-  const index = window.store.aiChatHistory.findIndex(i => i.id === chatEntry.id)
-  if (index !== -1) {
-    Object.assign(window.store.aiChatHistory[index], updates)
-    window.store.aiChatHistory = [...window.store.aiChatHistory]
-  }
+  window.store.updateAiHistoryEntry(chatEntry.id, updates)
 }
 
-async function callBackendAIchatWithTools (messages, config) {
+async function callBackendAIchatWithTools (messages, config, requestId) {
   return window.pre.runGlobalAsync(
     'AIchatWithTools',
     messages,
@@ -44,7 +62,11 @@ async function callBackendAIchatWithTools (messages, config) {
     config.apiKeyAI,
     config.proxyAI,
     agentTools,
-    config.authHeaderNameAI
+    config.authHeaderNameAI,
+    // `format` stays undefined (the main process detects it); `requestId` is
+    // the last argument so that exact request can be cancelled on stop.
+    undefined,
+    requestId
   )
 }
 
@@ -67,7 +89,16 @@ function publishContext (messages, config, usage) {
 }
 
 export async function runAgentLoop (chatEntry, config, abortRef, setIsStreaming, conversationMessages = null) {
+  const runId = uid()
+  activeRunId = runId
   window.store.agentRunning = true
+  const isAborted = () => !!(abortRef && abortRef.current)
+  // Auto compression bookkeeping, read by the finally block as well: how many
+  // times this run compacted itself, whether it failed on the way, and the
+  // size at the last summary attempt (AUTO_COMPRESS_RETRY_GROWTH_PERCENT)
+  let autoCompressCount = 0
+  let autoCompressAttemptTokens = 0
+  let runErrored = false
   try {
     const messages = buildAgentMessages({
       systemPrompt: buildAgentSystemPrompt(config),
@@ -78,6 +109,13 @@ export async function runAgentLoop (chatEntry, config, abortRef, setIsStreaming,
     let accumulatedContent = ''
     let lastUsage = null
 
+    const markStopped = () => {
+      setIsStreaming(false)
+      updateChatEntry(chatEntry, {
+        response: accumulatedContent + '\n\n*(Agent stopped by user)*'
+      })
+    }
+
     setIsStreaming(true)
     updateChatEntry(chatEntry, {
       toolCalls: [],
@@ -85,21 +123,79 @@ export async function runAgentLoop (chatEntry, config, abortRef, setIsStreaming,
     })
 
     for (let iteration = 0; iteration < MAX_ITERATIONS; iteration++) {
-      if (abortRef && abortRef.current) {
-        setIsStreaming(false)
-        updateChatEntry(chatEntry, {
-          response: accumulatedContent + '\n\n*(Agent stopped by user)*'
-        })
+      if (isAborted()) {
+        markStopped()
         return
       }
 
       publishContext(messages, config, lastUsage)
-      const result = await callBackendAIchatWithTools(messages, config)
+
+      // Auto compression, when the popover toggle is on: the request about to
+      // go out carries the whole conversation plus a tool result per step, and
+      // past ~90% of the window the provider rejects it outright. Replacing the
+      // conversation with a summary first keeps the run alive; the stored
+      // session is compacted at the end (autoCompressSession), because that is
+      // what the next turn starts from.
+      const info = window.store.aiContextInfo
+      // A failed summary is only worth retrying once the context has grown by
+      // this much -- but never more than the trigger itself, or a threshold
+      // below it would let the retry floor decide when to compress.
+      const growthPercent = Math.min(
+        AUTO_COMPRESS_RETRY_GROWTH_PERCENT,
+        CONTEXT_DANGER_PERCENT
+      )
+      const grewEnough = info &&
+        info.tokens - autoCompressAttemptTokens >=
+          (info.windowSize || 0) * growthPercent / 100
+      if (
+        autoCompressEnabled() &&
+        canCompact(messages) &&
+        shouldAutoCompress(info) &&
+        grewEnough
+      ) {
+        autoCompressAttemptTokens = info.tokens
+        // Shown before the request rather than after: summarizing a nearly full
+        // window takes a while, and this badge is the only sign of why the run
+        // is waiting. Taken back if the summary comes back unusable.
+        updateChatEntry(chatEntry, { autoCompressCount: autoCompressCount + 1 })
+        const summary = await summarizeMessages(messages, config)
+        if (isAborted()) {
+          markStopped()
+          return
+        }
+        if (summary) {
+          applySummary(messages, summary)
+          autoCompressCount++
+          lastUsage = null
+          publishContext(messages, config, null)
+        } else {
+          updateChatEntry(chatEntry, { autoCompressCount })
+        }
+      }
+
+      const requestId = uid()
+      if (abortRef) {
+        abortRef.requestId = requestId
+      }
+      const result = await callBackendAIchatWithTools(messages, config, requestId)
+      if (abortRef && abortRef.requestId === requestId) {
+        abortRef.requestId = null
+      }
+
+      // Re-check after the await, before anything from the answer is used:
+      // stopping cancels the request, and neither the partial answer nor the
+      // resulting error belongs in the transcript.
+      if (isAborted()) {
+        markStopped()
+        return
+      }
+
       if (result.usage) {
         lastUsage = result.usage
       }
 
       if (result.error) {
+        runErrored = true
         setIsStreaming(false)
         updateChatEntry(chatEntry, {
           response: accumulatedContent + `\n\n**Error:** ${result.error}`
@@ -109,6 +205,7 @@ export async function runAgentLoop (chatEntry, config, abortRef, setIsStreaming,
 
       const assistantMessage = result.message
       if (!assistantMessage) {
+        runErrored = true
         setIsStreaming(false)
         updateChatEntry(chatEntry, {
           response: accumulatedContent || 'No response from AI.'
@@ -135,11 +232,8 @@ export async function runAgentLoop (chatEntry, config, abortRef, setIsStreaming,
       }
 
       for (const toolCall of assistantMessage.tool_calls) {
-        if (abortRef && abortRef.current) {
-          setIsStreaming(false)
-          updateChatEntry(chatEntry, {
-            response: accumulatedContent + '\n\n*(Agent stopped by user)*'
-          })
+        if (isAborted()) {
+          markStopped()
           return
         }
 
@@ -150,28 +244,32 @@ export async function runAgentLoop (chatEntry, config, abortRef, setIsStreaming,
           args = {}
         }
 
-        const toolEntry = {
+        toolCallsLog.push({
           id: toolCall.id,
           name: toolCall.function.name,
           args,
           status: 'running',
           result: null
-        }
-        toolCallsLog.push(toolEntry)
+        })
         updateChatEntry(chatEntry, {
           toolCalls: [...toolCallsLog]
         })
 
-        let toolResult
+        let finished
         try {
-          toolResult = await executeToolCall(toolCall.function.name, args)
-          toolEntry.status = 'completed'
-          toolEntry.result = toolResult
+          const toolResult = await executeToolCall(toolCall.function.name, args)
+          finished = { status: 'completed', result: toolResult }
         } catch (err) {
-          toolEntry.status = 'error'
-          toolEntry.result = err.message
+          finished = { status: 'error', result: err.message }
         }
 
+        // Swap in a new entry object instead of mutating the running one: the
+        // tool call card is memo()'d on that object's identity, so an in-place
+        // mutation would leave the card showing "running" forever.
+        toolCallsLog[toolCallsLog.length - 1] = {
+          ...toolCallsLog[toolCallsLog.length - 1],
+          ...finished
+        }
         updateChatEntry(chatEntry, {
           toolCalls: [...toolCallsLog]
         })
@@ -179,7 +277,7 @@ export async function runAgentLoop (chatEntry, config, abortRef, setIsStreaming,
         messages.push({
           role: 'tool',
           tool_call_id: toolCall.id,
-          content: toolEntry.result
+          content: finished.result
         })
       }
     }
@@ -189,9 +287,54 @@ export async function runAgentLoop (chatEntry, config, abortRef, setIsStreaming,
       response: accumulatedContent + '\n\n*(Agent reached maximum iterations)*'
     })
   } finally {
-    window.store.agentRunning = false
-    // hand the panel back to the session based estimate: tool results are not
-    // carried into the next turn, so the agent figure stops being meaningful
-    window.store.aiContextInfo = null
+    if (abortRef) {
+      abortRef.requestId = null
+    }
+    // Only the run that still owns the flag may clear it -- a stopped run
+    // unwinds a moment later and must not unlock a newer one.
+    const ownsRun = activeRunId === runId
+    if (ownsRun) {
+      activeRunId = null
+      window.store.agentRunning = false
+      // hand the panel back to the session based estimate: tool results are not
+      // carried into the next turn, so the agent figure stops being meaningful
+      window.store.aiContextInfo = null
+    }
+    // A run that compacted its live conversation leaves the stored session
+    // untouched, so the next turn would start from the full history again and
+    // pay for another summary. Compact the session as well -- once, after the
+    // run, when the turns it summarizes are complete. Skipped for a stopped or
+    // failed run: those transcripts are not a conversation worth keeping.
+    if (ownsRun && autoCompressCount > 0 && !runErrored && !isAborted()) {
+      await autoCompressSession(chatEntry.chatSessionId, config)
+    }
+  }
+}
+
+// Stop the running agent loop, called by the panel's stop button.
+//
+// The loop itself only looks at `abortRef` between iterations, so on its own
+// that flag does nothing while a request is in flight -- and the panel keeps
+// the composer locked for as long as the provider takes to answer (which is
+// forever if it never does, these requests carry no timeout). So this also
+// cancels the in-flight request and releases the composer right away; the loop
+// then unwinds on its own and marks the entry as stopped.
+export async function stopAgentRun (abortRef) {
+  if (abortRef) {
+    abortRef.current = true
+  }
+  const requestId = abortRef && abortRef.requestId
+  if (abortRef) {
+    abortRef.requestId = null
+  }
+  activeRunId = null
+  window.store.agentRunning = false
+  window.store.aiContextInfo = null
+  if (requestId) {
+    try {
+      await window.pre.runGlobalAsync('abortAIRequest', requestId)
+    } catch (error) {
+      console.error('Error aborting agent request:', error)
+    }
   }
 }